Message ID | 1547529039-26786-1-git-send-email-wenxu@ucloud.cn |
---|---|
State | Awaiting Upstream |
Delegated to: | David Miller |
Headers | show |
Series | netfilter: nft_meta: Add NFT_META_L3MASTER meta type | expand |
wenxu@ucloud.cn <wenxu@ucloud.cn> wrote: > From: wenxu <wenxu@ucloud.cn> > so with this patch userspace can add the 'don't re-do entire ruleset for vrf' policy > itself like the following > > nft add rule firewall rules-all meta l3master true counter accept I wonder if we need to support this also for output interface, and if this should be specific to vrf or not. Example: meta iifl3master exists accept meta oifl3master exists accept or meta iifkind "vrf" accept meta oifkind "vrf" accept (the latter could e.g. place rtnl_op ".kind" in the register) Not sure if that would ever be useful beyond vrf.
On 2019/1/15 下午7:17, Florian Westphal wrote: > wenxu@ucloud.cn <wenxu@ucloud.cn> wrote: >> From: wenxu <wenxu@ucloud.cn> >> so with this patch userspace can add the 'don't re-do entire ruleset for vrf' policy >> itself like the following >> >> nft add rule firewall rules-all meta l3master true counter accept > I wonder if we need to support this also for output interface, and if > this should be specific to vrf or not. > > Example: > > meta iifl3master exists accept > meta oifl3master exists accept > or > meta iifkind "vrf" accept > meta oifkind "vrf" accept > > (the latter could e.g. place rtnl_op ".kind" in the register) > > Not sure if that would ever be useful beyond vrf. > yes, iifkind type mus useful for most other cases.
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 7de4f1b..dc45972 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -789,6 +789,7 @@ enum nft_exthdr_attributes { * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) * @NFT_META_PRANDOM: a 32bit pseudo-random number * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp) + * @NFT_META_L3MASTER: boolean, netif_is_l3_master(dev) */ enum nft_meta_keys { NFT_META_LEN, @@ -817,6 +818,7 @@ enum nft_meta_keys { NFT_META_CGROUP, NFT_META_PRANDOM, NFT_META_SECPATH, + NFT_META_L3MASTER, }; /** diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 6df486c..84c8151 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -244,6 +244,11 @@ void nft_meta_get_eval(const struct nft_expr *expr, strncpy((char *)dest, p->br->dev->name, IFNAMSIZ); return; #endif + case NFT_META_L3MASTER: + if (in == NULL) + goto err; + nft_reg_store8(dest, netif_is_l3_master(in)); + break; default: WARN_ON(1); goto err; @@ -359,6 +364,9 @@ static int nft_meta_get_init(const struct nft_ctx *ctx, len = IFNAMSIZ; break; #endif + case NFT_META_L3MASTER: + len = sizeof(u8); + break; default: return -EOPNOTSUPP; }